From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) by finch.gentoo.org (Postfix) with ESMTP id 002201381F3 for ; Mon, 23 Sep 2013 06:29:46 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 2AC06E09EC; Mon, 23 Sep 2013 06:29:32 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 17955E09E5 for ; Mon, 23 Sep 2013 06:29:30 +0000 (UTC) Received: from hornbill.gentoo.org (hornbill.gentoo.org [94.100.119.163]) (using TLSv1 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id EFB7433ED4B for ; Mon, 23 Sep 2013 06:29:29 +0000 (UTC) Received: from localhost.localdomain (localhost [127.0.0.1]) by hornbill.gentoo.org (Postfix) with ESMTP id 6F728E5463 for ; Mon, 23 Sep 2013 06:29:27 +0000 (UTC) From: "Sven Vermeulen" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Sven Vermeulen" Message-ID: <1379917683.f32d2da8b2f3a4cbaf11f9eb0a1c27d1678ce4d5.SwifT@gentoo> Subject: [gentoo-commits] proj/hardened-refpolicy:merge commit in: policy/modules/contrib/ X-VCS-Repository: proj/hardened-refpolicy X-VCS-Files: policy/modules/contrib/hypervkvp.fc policy/modules/contrib/hypervkvp.if policy/modules/contrib/hypervkvp.te X-VCS-Directories: policy/modules/contrib/ X-VCS-Committer: SwifT X-VCS-Committer-Name: Sven Vermeulen X-VCS-Revision: f32d2da8b2f3a4cbaf11f9eb0a1c27d1678ce4d5 X-VCS-Branch: merge Date: Mon, 23 Sep 2013 06:29:27 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: 2644605f-88b9-40b3-a290-f5f3fa31a480 X-Archives-Hash: c5f76317908f46674c377f0fb7f263a6 commit: f32d2da8b2f3a4cbaf11f9eb0a1c27d1678ce4d5 Author: Dominick Grift gmail com> AuthorDate: Fri Sep 20 07:12:29 2013 +0000 Commit: Sven Vermeulen siphos be> CommitDate: Mon Sep 23 06:28:03 2013 +0000 URL: http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=f32d2da8 Clean up hypervkvp policy module (seems incomplete) Signed-off-by: Dominick Grift gmail.com> --- policy/modules/contrib/hypervkvp.fc | 4 ++-- policy/modules/contrib/hypervkvp.if | 31 +++++++++++++++++++++---------- policy/modules/contrib/hypervkvp.te | 24 +++++++++++------------- 3 files changed, 34 insertions(+), 25 deletions(-) diff --git a/policy/modules/contrib/hypervkvp.fc b/policy/modules/contrib/hypervkvp.fc index 2a69ee4..b46130e 100644 --- a/policy/modules/contrib/hypervkvp.fc +++ b/policy/modules/contrib/hypervkvp.fc @@ -1,3 +1,3 @@ -/etc/rc\.d/init\.d/hypervkvpd -- gen_context(system_u:object_r:hypervkvp_initrc_exec_t,s0) +/etc/rc\.d/init\.d/hypervkvpd -- gen_context(system_u:object_r:hypervkvpd_initrc_exec_t,s0) -/usr/sbin/hv_kvp_daemon -- gen_context(system_u:object_r:hypervkvp_exec_t,s0) +/usr/sbin/hv_kvp_daemon -- gen_context(system_u:object_r:hypervkvpd_exec_t,s0) diff --git a/policy/modules/contrib/hypervkvp.if b/policy/modules/contrib/hypervkvp.if index 7743be5..6517fad 100644 --- a/policy/modules/contrib/hypervkvp.if +++ b/policy/modules/contrib/hypervkvp.if @@ -1,21 +1,32 @@ - -## policy for hypervkvp +## HyperV key value pair (KVP). ######################################## ## -## Execute TEMPLATE in the hypervkvp domin. +## All of the rules required to +## administrate an hypervkvp environment. ## ## -## -## Domain allowed to transition. -## +## +## Domain allowed access. +## ## +## +## +## Role allowed access. +## +## +## # -interface(`hypervkvp_domtrans',` +interface(`hypervkvp_admin',` gen_require(` - type hypervkvp_t, hypervkvp_exec_t; + type hypervkvpd_t, hypervkvpd_initrc_exec_t; ') - corecmd_search_bin($1) - domtrans_pattern($1, hypervkvp_exec_t, hypervkvp_t) + allow $1 hypervkvpd_t:process { ptrace signal_perms }; + ps_process_pattern($1, hypervkvpd_t) + + init_labeled_script_domtrans($1, hypervkvpd_initrc_exec_t) + domain_system_change_exemption($1) + role_transition $2 hypervkvpd_initrc_exec_t system_r; + allow $2 system_r; ') diff --git a/policy/modules/contrib/hypervkvp.te b/policy/modules/contrib/hypervkvp.te index 631ed79..4eb7041 100644 --- a/policy/modules/contrib/hypervkvp.te +++ b/policy/modules/contrib/hypervkvp.te @@ -5,26 +5,24 @@ policy_module(hypervkvp, 1.0.0) # Declarations # -type hypervkvp_t; -type hypervkvp_exec_t; -init_daemon_domain(hypervkvp_t, hypervkvp_exec_t) - -type hypervkvp_initrc_exec_t; -init_script_file(hypervkvp_initrc_exec_t) +type hypervkvpd_t; +type hypervkvpd_exec_t; +init_daemon_domain(hypervkvpd_t, hypervkvpd_exec_t) +type hypervkvpd_initrc_exec_t; +init_script_file(hypervkvpd_initrc_exec_t) ######################################## # -# hypervkvp local policy +# Local policy # # -allow hypervkvp_t self:fifo_file rw_fifo_file_perms; -allow hypervkvp_t self:unix_stream_socket create_stream_socket_perms; -domain_use_interactive_fds(hypervkvp_t) +allow hypervkvpd_t self:fifo_file rw_fifo_file_perms; +allow hypervkvpd_t self:unix_stream_socket create_stream_socket_perms; -logging_send_syslog_msg(hypervkvp_t) +logging_send_syslog_msg(hypervkvpd_t) -miscfiles_read_localization(hypervkvp_t) +miscfiles_read_localization(hypervkvpd_t) -sysnet_dns_name_resolve(hypervkvp_t) +sysnet_dns_name_resolve(hypervkvpd_t) From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) by finch.gentoo.org (Postfix) with ESMTP id 614DB1381F3 for ; Mon, 23 Sep 2013 13:31:56 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 01487E0ADD; Mon, 23 Sep 2013 13:31:48 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 5ED52E0ADD for ; Mon, 23 Sep 2013 13:31:47 +0000 (UTC) Received: from hornbill.gentoo.org (hornbill.gentoo.org [94.100.119.163]) (using TLSv1 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id 2E06F33ED83 for ; Mon, 23 Sep 2013 13:31:46 +0000 (UTC) Received: from localhost.localdomain (localhost [127.0.0.1]) by hornbill.gentoo.org (Postfix) with ESMTP id C55C1E546E for ; Mon, 23 Sep 2013 13:31:43 +0000 (UTC) From: "Sven Vermeulen" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Sven Vermeulen" Message-ID: <1379917683.f32d2da8b2f3a4cbaf11f9eb0a1c27d1678ce4d5.SwifT@gentoo> Subject: [gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/ X-VCS-Repository: proj/hardened-refpolicy X-VCS-Files: policy/modules/contrib/hypervkvp.fc policy/modules/contrib/hypervkvp.if policy/modules/contrib/hypervkvp.te X-VCS-Directories: policy/modules/contrib/ X-VCS-Committer: SwifT X-VCS-Committer-Name: Sven Vermeulen X-VCS-Revision: f32d2da8b2f3a4cbaf11f9eb0a1c27d1678ce4d5 X-VCS-Branch: master Date: Mon, 23 Sep 2013 13:31:43 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: 62d66d36-5ecc-4526-bf46-b0e12b5c19fd X-Archives-Hash: dd098e8f104f8aa8a3b00ffbed4757a1 Message-ID: <20130923133143.XaPCcdqkjfCEV6dmnaltfz22uSMyrRx0lQY61BeIJJE@z> commit: f32d2da8b2f3a4cbaf11f9eb0a1c27d1678ce4d5 Author: Dominick Grift gmail com> AuthorDate: Fri Sep 20 07:12:29 2013 +0000 Commit: Sven Vermeulen siphos be> CommitDate: Mon Sep 23 06:28:03 2013 +0000 URL: http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=f32d2da8 Clean up hypervkvp policy module (seems incomplete) Signed-off-by: Dominick Grift gmail.com> --- policy/modules/contrib/hypervkvp.fc | 4 ++-- policy/modules/contrib/hypervkvp.if | 31 +++++++++++++++++++++---------- policy/modules/contrib/hypervkvp.te | 24 +++++++++++------------- 3 files changed, 34 insertions(+), 25 deletions(-) diff --git a/policy/modules/contrib/hypervkvp.fc b/policy/modules/contrib/hypervkvp.fc index 2a69ee4..b46130e 100644 --- a/policy/modules/contrib/hypervkvp.fc +++ b/policy/modules/contrib/hypervkvp.fc @@ -1,3 +1,3 @@ -/etc/rc\.d/init\.d/hypervkvpd -- gen_context(system_u:object_r:hypervkvp_initrc_exec_t,s0) +/etc/rc\.d/init\.d/hypervkvpd -- gen_context(system_u:object_r:hypervkvpd_initrc_exec_t,s0) -/usr/sbin/hv_kvp_daemon -- gen_context(system_u:object_r:hypervkvp_exec_t,s0) +/usr/sbin/hv_kvp_daemon -- gen_context(system_u:object_r:hypervkvpd_exec_t,s0) diff --git a/policy/modules/contrib/hypervkvp.if b/policy/modules/contrib/hypervkvp.if index 7743be5..6517fad 100644 --- a/policy/modules/contrib/hypervkvp.if +++ b/policy/modules/contrib/hypervkvp.if @@ -1,21 +1,32 @@ - -## policy for hypervkvp +## HyperV key value pair (KVP). ######################################## ## -## Execute TEMPLATE in the hypervkvp domin. +## All of the rules required to +## administrate an hypervkvp environment. ## ## -## -## Domain allowed to transition. -## +## +## Domain allowed access. +## ## +## +## +## Role allowed access. +## +## +## # -interface(`hypervkvp_domtrans',` +interface(`hypervkvp_admin',` gen_require(` - type hypervkvp_t, hypervkvp_exec_t; + type hypervkvpd_t, hypervkvpd_initrc_exec_t; ') - corecmd_search_bin($1) - domtrans_pattern($1, hypervkvp_exec_t, hypervkvp_t) + allow $1 hypervkvpd_t:process { ptrace signal_perms }; + ps_process_pattern($1, hypervkvpd_t) + + init_labeled_script_domtrans($1, hypervkvpd_initrc_exec_t) + domain_system_change_exemption($1) + role_transition $2 hypervkvpd_initrc_exec_t system_r; + allow $2 system_r; ') diff --git a/policy/modules/contrib/hypervkvp.te b/policy/modules/contrib/hypervkvp.te index 631ed79..4eb7041 100644 --- a/policy/modules/contrib/hypervkvp.te +++ b/policy/modules/contrib/hypervkvp.te @@ -5,26 +5,24 @@ policy_module(hypervkvp, 1.0.0) # Declarations # -type hypervkvp_t; -type hypervkvp_exec_t; -init_daemon_domain(hypervkvp_t, hypervkvp_exec_t) - -type hypervkvp_initrc_exec_t; -init_script_file(hypervkvp_initrc_exec_t) +type hypervkvpd_t; +type hypervkvpd_exec_t; +init_daemon_domain(hypervkvpd_t, hypervkvpd_exec_t) +type hypervkvpd_initrc_exec_t; +init_script_file(hypervkvpd_initrc_exec_t) ######################################## # -# hypervkvp local policy +# Local policy # # -allow hypervkvp_t self:fifo_file rw_fifo_file_perms; -allow hypervkvp_t self:unix_stream_socket create_stream_socket_perms; -domain_use_interactive_fds(hypervkvp_t) +allow hypervkvpd_t self:fifo_file rw_fifo_file_perms; +allow hypervkvpd_t self:unix_stream_socket create_stream_socket_perms; -logging_send_syslog_msg(hypervkvp_t) +logging_send_syslog_msg(hypervkvpd_t) -miscfiles_read_localization(hypervkvp_t) +miscfiles_read_localization(hypervkvpd_t) -sysnet_dns_name_resolve(hypervkvp_t) +sysnet_dns_name_resolve(hypervkvpd_t)